Coming Soon: SAQ Updates
On 30 January the PCI SSC will publish minor updates to Self-Assessment Questionnaires (SAQ), the validation tools that eligible merchants and service providers use to report the results of their PCI Data Security Standard (PCI DSS) self-assessment. The changes clarify points of confusion PCI SSC has heard from industry stakeholders since the SAQs were updated to align with PCI DSS version 3.2 in April 2016.
There is a transition period to allow merchants time to review changes to applicable SAQs and prepare to adopt them. Merchants may continue to use the SAQs published in April 2016 until 30 September 2017. Starting on 1 October 2017, merchants will need to use the updated SAQs. Prior to 1 October 2017, merchants can use either the April 2016 or the January 2017 version of the SAQs.
The updated SAQs will be available in the Document Library on the PCI SSC website on 30 January. The PCI Council encourages you to review the key changes to these SAQs to understand and prepare for how you and/or your merchant customers may be impacted by these.
As a reminder, merchants should contact their acquirer or the applicable payment brand(s) to understand if they are eligible or required to submit an SAQ, and if so, which SAQ is appropriate for their environment. The SAQ Instructions and Guidelines document also provides additional guidance about the PCI DSS self-assessment process and the different SAQs.